Which of the following is the MOST effective way to reduce potential losses due to ongoing expense fraud?

User access controls, particularly when combined with segregation of duties, directly prevent individuals from performing actions that would constitute expense fraud, such as submitting, approving, and disbursing funds for the same expense. They are preventive measures that limit the ability to commit fraud.

Regular internal audits are detective controls that identify fraud after it has occurred, which helps deter future fraud but does not prevent ongoing losses as effectively as preventive access controls.

Developing and communicating fraud prevention policies sets expectations but does not directly prevent fraudulent actions if controls are not in place to enforce them.

Fraud prevention awareness training educates employees but relies on individual compliance and does not inherently prevent a determined fraudster, especially without technical controls.